Your account

Profile, language, password, signing out everywhere.

Profile

In “Profile” you change your name, organisation, position and interface language. Your e-mail is your login; to change it, ask a Portal Owner.

The “My suggestions” card there shows how many suggestions you sent to the developer and links to their status and answers.

Password

Passwords are at least 10 characters. After a change you get an e-mail notice. If you forget it, click “Forgot password?” on the sign-in page: the reset link arrives by e-mail and works for one hour.

Two-step sign-in (a code from the e-mail)

By default the e-mail and the password are enough to sign in. The “Two-step sign-in” card in the Profile switches on a second step: after the password the portal sends a 6-digit code to your e-mail, and sign-in opens only with it. The code works for 10 minutes and only once; after 5 wrong tries it stops working, and wrong codes count as wrong passwords (8 in a row close sign-in for 15 minutes). The second step is switched on and off only with the current password, and every change is announced by a letter.

A project's owner can ask the second step of the whole team: the project settings have the card “Two-step sign-in for the team”. Members of such a project then pass the second step at every sign-in, and if the owner switches it on during a session, the portal asks for the code once before going on. Either way satisfies it: a code from the authenticator app or a code from the e-mail. Switching it on and off, every sign-in with the code and every wrong code are written to the audit trail.

Authenticator app (TOTP)

The other way to pass the second step works without mail: a 6-digit code from an app on your phone that changes every 30 seconds (any one-time code app for TOTP works, for example the one built into a password manager). In the Profile, in the “Two-step sign-in” card, on the row “Authenticator app”, enter the current password and press “Set up”. A page opens with a QR code and the key as text (for when the QR code does not scan): scan the code with the app and enter the code it shows. The portal draws the QR code itself and the key goes nowhere; the database keeps it only encrypted.

Right after switching it on the portal shows 10 recovery codes, once. Save them in a password manager or print them: if the phone is lost, each code opens the sign-in once instead of the app. The database keeps only their hashes, so they cannot be shown again. The Profile shows how many are left, and “New recovery codes” (with the password) makes ten new ones; the old ones stop working.

At sign-in with the app on the portal asks for the code from the app. The links under the field lead to the other ways: “Use a recovery code” and, only if you switched the e-mail code on too, “Send a code to the e-mail instead”. A code is accepted for the current 30 seconds and the neighbouring ones (a phone's clock may run a little fast or slow), and each code works once: a code seen over a shoulder does not open a second session. Wrong codes count as wrong passwords.

If the phone and the codes are lost, the Portal Owner resets the app on the user's page (“Reset the app”, with a reason); after that sign-in goes with the password, and the app is set up again. Switching it on and off, new recovery codes, the Portal Owner's reset and every sign-in are written to the audit trail (21 CFR 11.10(e)): the sign-in record names the way of the second step, and a sign-in with a recovery code how many codes are left.

Sign out everywhere

If you signed in on someone else's computer or lost a phone, click “Sign out on all devices”. Every other session ends; the current one stays.

Lockout

After 8 wrong passwords in a row, sign-in is blocked for 15 minutes. A Portal Owner can lift the block sooner.